Anonymity, privacy -- these are things we have come to expect when it comes to our cell phones. The last thing people anticipate is for unknown -- possibly malicious -- third parties to able to quickly track our positions every time we place a phone call.

They then conducted two attacks geared at tracking the victim's position. The attacks were conducted in Europe on a number of real-world networks, across various carriers.

The researchers used a so-called "paging attack" -- a denial-of-service (DOS) type attack that involves tricking basestations or mobile devices into an always "ready" state. By sending a TMSI (Temporary Mobile Subscriber Identity) which appeared to contain a static IMSI (International Mobile Subscriber Identity), the attacker tricked the victim device into giving up its real IMSI.

That in turn allowed the target to be continuously tracked within a monitored region.

A second route to monitoring was also demonstrated, which used an Authentication and Key Agreement (AKA) protocol attack. The target device returns a Mac error, while the rest of the devices would respond with a different error -- a synchronization error.

The authors write, "The captured authentication request can now be replayed by the adversary each time he wants to check the presence of [a device] in a particular area. In fact, thanks to the error messages, the adversary can distinguish any mobile station from the one the authentication request was originally sent to."

The caveat here is that the attackers first had to indentify example authentication requests by calling the victim's device. But they argue that the flaw could still be abused in certain scenarios, such as if a boss wanted to track employees in a large office building.

The researchers elaborate, "[The employer] would first use the femtocell to sniff a valid authentication request. This could happen in a different area than the monitored one. Then the employer would position the device near the entrance of the building. Movements inside the building could be tracked as well by placing additional devices to cover different areas of the building. If devices with wider area coverage than a femtocell are used, the adversary should use triangulation to obtain finer position data."

II. Fixing the Flaws

So what does all of this mean?? 3G networks -- any 3G network, according to the authors -- are vulnerable to tampering which allows their users to be tracked, due to protocol weaknesses.

The IMSI paging attack flaw seems to be the more dangerous attack as it can be used to track anonymous victims.

Fortunately, there's a fix to both problems. The fix is to both modify the error messages, and adopt certain protocol changes. Those changes would involve introducing a so-called "unlikability" session key to weed out malicious AKA requests, and to implement IMSI paging procedure fixes to prevent the DOS trickery.

The 3G mobile industry's security watchdog, 3GPP, is investigating the proof-of-concept attacks and is considering the proposed fixes, which the authors argue would have a "low... computational and economical cost". Those fixes could (in theory) be rolled out in coming months to prevent attackers from exploiting "in the wild" the soon-to-be-published flaw.

How do you think a phone call gets charged to your bill and you even receive a CELL phone call in the 1st place.

Easy enough right, cell towers. Cell towers triangulate and your phone sends signal out for discovery, similar concept the the old days of televisions getting the TV signal over the air via rabbit ears, just now it goes 2 way vs 1 way receiver.

You dont have to have any gps or so called air plane mode, once a cell phone makes use of any data and cell towers in the area pick up the signals and know where you are.

"There's no chance that the iPhone is going to get any significant market share. No chance." -- Microsoft CEO Steve Ballmer